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IN THE CLAIMS: 
Amended claims follow; 

1. (currently amended) A computer program product comprising a computer 
program operable to control a computer to detect a known computer program within a 
packed computer file, said packed computer file being unpacked upon execution, said 
computer program comprising; 

resource data reading logic for reading resource data within said packed computer 
file, said lesource data speciiying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

resource data comparing logic fot generating characteristics of said resource data 
and for comparing said characteristics of said resource data with characteristics of 
resource data of said known computer program and for detecting a match with said 
known computer program indicative of said packed computer file containing said known 
computer program; 

wher^ip said resource data of said mcke<\ comnmi.r fil^ j.. nce^^ tn ^ ^r^^.. 
flnRcrprint data and to romn^r^ said fino.rp nW h. .^ with fin.e.rp int H ata of said knnwn 
computer p rnfn-am; 

Wherein said finperprint data includr,s a nm^iher »f p mpram resnnrr^ it.m. 
specified withi n said resource djita; 

Wherein said fin(re.mrint data fnr.ln^.. . fl. g indi.,«tina wh,Vh data i. inrb.HM 
within said fi ngerprint data . 
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2. (original) A computer program product as claimed in claim 1, wherein said 
known computer program is one of: 

a Trojan computer program; and 
a wonn computer program. 

3. (original) A computer program product as claimed in claim 1, wherein said 
resource data comparing logic is operable to compare said resource data with 
characteristics of a plurality of known computer programs to detect if said packed 
computer program contains one of said plurality of known computer programs. 

4. (cancelled) 

5. (original) A computer program product as claimed in claim 1, wherein said 
program resource items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 
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6. (original) A computer program product as claimed in claim 1, wherein said 
resource data specifies for each resource item a storage location of said resource item. 

7. (original) A computer program product as claimed in claim 6. wherein said 
storage location of said resource item is specified as an relative offset value. 

8 . (original) A computer program product as claimed in claim 1 , wherein said 
resource data specifies for each resource item a size of said resource item, 

9. (currently amended) A computer program product as claimed in claim [4]1, 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

Sizes of program resource items within said resource data. 

10. (cancelled) 

1 1 . (currently amended) A computer program product as claimed in claim [4]i, 
wherein said fingerprint data includes a location within said resource data of an entry 
specifying a program resource item having a largest size. 
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12. (currently amended) A computer program product as claimed in claim [4]i> 
wherein said fingerprint data includes timestamp data indicative of a time of compilation 
of said known computer program. 

13. (cancelled) 

14. (original) A computer program product as claimed in claim 9, wherein said 
checksum value is rotated between each item beitig added into said checksum. 

15. (original) A computer program product as claimed in claim 1 , wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

16. (original) A computer program product as claimed in claim I, wherein said 
packed computer file is a Win32 PE file, 

17. (currently amended) A computer program product comprising a computer 
program operable to control a computer to generate data for detecting a known computer 
program within a packed computer file, said packed computer file being unpacked upon 
execution, said computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
file, said resource data specifying program resource items used by said known computer 
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program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

characteristic data generating logic for generating characteristic data associated 
with said resource data for comparison with characteristic data of resource data of said 
known computer program to detect a match with said known computer program 
indicative of said packed computer file containing said known computer program^ 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
comt)uter program: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 



18. (original) A computer program product as claimed in claim 1 7, wherein said 
known computer program is one of: 

a Trojan computer program; and 
a worm computer program. 

19. (cunently amended) A computer program product as claimed in claim 17, 
wherein said characteristic data generating logic is operable to generate characteristic 
data firom a plurality of known computer programs to enable detection of any of said 
plurality of known computer programs within said packed computer program.[.] 



PAGE 9/30 ^ R(afD AT 10/I2/20M 4:59:50 PM [Eastern 



OCT. 1 2. 2005 2:1 1 PM ZILKA-KOTAB. PC 

-7- 



NO.0503 P. 10 



20. (cancelled) 

21 . (original) A computer program product as claimed in claim 1 7, wherein said 
program resource items used by said knovvn computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

22. (original) A computer program product as claimed in claim 17, wherein said 
resource data specifies for each resource item a storage location of said resource item. 

23. (original) A computer program product as claimed in claim 22, wherein said 
storage location of said resource item is specified as an relative offset value. 

24. (original) A computer program product as claimed in claim 17, wherein said 
resource data specifies for each resource item a size of said resource item. 
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25. (ciurently amended) A computer program product as claimed in claim [20]VL 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said reso\irce data; 

and 

sizes of program resource items within said resource data, 

26. (cancelled) 

27. (currently amended) A computer program product as claimed in claim [20117, 
wherein said fingerprint data includes a location within said resource data of an entry 
specifying a program resource item having a largest size, 

28. (currently amended) A computer program product as claimed in claim [20)17, 
wherein said fingerprint data includes timestamp data indicative of a time of compilation 
of said known computer program. 

29. (cancelled) 

30. (original) A computer program product as claimed in claim 25, wherein said 
checksum value is rotated between each item being added into said checksum. 
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31. (original) A computer program product as claimed in claim 17, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program, 

32. (original) A computer program product as claimed in claim 17, wherein said 
packed computer file is a Win32 PE file. 

33. (currently amended) A method of controlling a computer to detect a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristics of said resource data and comparing said characteristics 
of said resource data with characteristics of resource data of said known computer 
program and detecting a match with characteristics of said known computer program 
indicative of said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program: 
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whcrein said fingerprint data includes a number o f program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating whic h data is included 
within said fingerprint data . 

34. (original) A method as claimed in claim 33, wherein said known computer 
program is one of; 

a Trojan computer program; and 
a worm computer program. 

35. (original) A method as claimed in claim 33, wherein said step of comparing 
compares said resource data with characteristics of a plurality of known computer 
programs to detect if said packed computer program contains one of said plurality of 
known computer programs. 

36. (cancelled) 

37. (original) A method as claimed in claim 33, wherein said program resource 
items used by said known computer prograni include one or more of: 

icon data; 
string dataj 
dialog data; 
bitmap data; 
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menu data; and 
language data, 

38. (original) A method as claimed in claim 33, wherein said resource data 
specifies for each resource item a storage location of said resoxjrce item. 

39. (original) A method as clauned in claim 38, wherein said storage location of 
said resource item is specified as an relative offset value. 

40. (original) A method as claimed in claim 33, wherein said resource data 
specifies for each resource item a size of said resource item, 

41 . (currently amended) A method as claimed in claim [36]33, wherein said 
fmgerprint data includes a checksum value calculated in dependence upon one or mote 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

42. (cancelled) 
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43. (currently amended) A method as claimed in claim [36] 33, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size. 

44. (currently amended) A method as claimed in claim [36]31, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

45. (cancelled) 

46. (original) A method as claimed in claim 41, wherein said checksum value is 
rotated between each item being added into said checksxim- 

47. (original) A method as claimed in claim 33, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

48. (original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PE file. 

49. (currently amended) A method of controlling a computer to generate data for 
detecting a known computer program within a packed computer file, said packed 
computer file being unpacked upon execution, said method comprising the steps of: 
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reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristic dala associated with said resource data for comparison 
with characteristic data of resource data of said known computer program and detecting a 
match with said known computer program indicative of said packed computer file 
containing said known computer programi 

wherein said respurcff data of .saifl mcked comp utet fil e is mocesf^^A tn p ^n^t. 
fingerprint data 9n<^ fo compare said finTCrorint data with fingemriTit dat;, of said Imnwn 
computer prppram; 

wherein said fingerprint H«f^ includes a number of tirnff -am resource items 
specified within said resource data; 

herein said fingerprint da ta include . s a flag indicaiinff w hich data k .'nnl„^.w 
within said fingerprint dat^ 

50. (original) A method as claimed in claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

51 . (currently amended) A method as claimed in claim 49, wherein said step of 
generating generates characteristic data fi-om a plurality of known computer programs to 
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enable detection of any of said plurality of known computer programs within said packed 
computer program. [.] 

52, (cancelled) 

53. (original) A method as claimed in claim 49, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data, 

54. (original) A method as claimed in claim 49, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

55. (original) A method as claimed in claim 54, wherein said storage location of 
said resource item is specified as an relative offset value. 

56. (original) A method as claimed in claim 49, wherein said resource data 
specifies for each resoxirce item a size of said resource item. 
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a.B^.d«a,„clud«acl.cok™ , " "™ f^^M- said 

a number of program resource 
siring Qames associated with nm^r 
^ of program 

58. (cancelled) 



Pf ogran, resource item having a largest 



said 

entry specifying a 



size. 



so. (currena, ™) A „^<^ a. cH^ed i„ da,,, f^j^J, v^e.. .aid 

da.i„c,ud«d:„as«.r,p,a.i,,di«,veofau„.o,,„„,„,„„„,^, 
known computer program. 



61. (cancelled) 

62. CoriginaJ) A method as claimed in t- <-» 

^is ciamied m claim 57, wherein said checksum value is 

rotated between each item being added into said checksum. 
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63. (original) A method as claimed in claim 49, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

64. (original) A method as claimed in claim 49, wherein said packed computer 
file is a Win32 PE file. 

65. (currently amended) Apparatus for detecting a known computer program 
within a packed computer file, said packed computer file being unpacked upon execution, 
said apparatus comprising: 

a resource data reader for reading resource data within said packed computet file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a resource data comparator for generating characteristics of said resource data and 
for comparing said characteristics of said resource data with characteristics of resource 
data of said known computer program for detecting a match with said known computer 
program indicative of said packed computer file containing said known computer 
program^ 

wherein said resource data of said packed com puter file is processed to generate 
finger print data and to comnare said fmperprint data w ith fingerprint data of said known 
computer profijam: 
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Wherein said frn per print date i nrltides a numh^r nf p rogram resource it^. 
specified w^fhin said resourcfi Hata; 

Wherein said fin ger print data i ncludes a flag mdic.tin f. which data ^M.a 
within said fingerprint d^ta 

66. (original) Apparatus as claimed in claim 65. wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

67. (previously presented) Apparatus as claimed in claim 65, wherein said 
resource data comparator is operable to compare said resource data with characteristics of 
a pluraUty of known computer programs to detect if said packed computer program 
contains one of said plurality of known computer programs. 

68. (cancelled) 

69. (original) Apparatus as claimed in claim 65, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
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menu data; and 
language data. 

70. (original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a storage location of said resource item, 

71 . (original) Apparatus as claimed in claim 70, wherein said storage location of 
said resource item is specified as an relative offset value. 

72. (original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a size of said resource item. 

73. (currently amended) Apparatus as claimed in claim [68]65, wherein said 
fmgeiprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

74. (cancelled) 
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75. (currently amended) Apparatus as claimed in claim [68]65, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size. 

76. (currently amended) Apparatus as claimed in claim [68]65, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

77. (cancelled) 

78. (original) Apparatus as claimed m claim 73, wherein said checksum value is 
rotated between each item being added into said checksum. 

79. (original) Apparatus as claimed in claim 65, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

80. (original) Apparatus as claimed in claim 65, wherein said packed computer 
file is a Win32 PE file. 

81. (currently amended) Apparatus for generating data for detecting a known 
computer program within a packed computer file, said packed computer file being 
impacked upon execution, said apparatus comprising: 
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a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system v^thout dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a characteristic data generator for generating characteristic data associated with 
said resource data for comparison with characteristic data of resource data of said known 
computer program and for detecting a match with said known computer program 
indicative of said packed computer file containing said known computer program; 

wherein said resource data of said p acked r n mputer file ia processed to genftrnte 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer pro pjrflm; 

Wherein ?aid fingerprint data includes a me mber of nrograni resource item.<= 
specified within said resource dfltft; 

wherein said fingerprint data includes a flap i ndicating which data is inr.lnd^rf 
wifliin said fingerprint data. 

82. (original) Apparatus as claimed in claim 81, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

83. (currently amended) Apparatus as claimed in claim 81. wherein said 
characteristic data generator is operable to generate characteristic data fi^om a plurality of 
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known computer programs to enable detection of any of said plurality of known 
computer programs wiiliin said packed computer program, [.] 

84. (cancelled) 

85. (original) Apparatus as claimed in claim 81, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

86. (original) Apparatus as claimed in claim 81, wherein ^d resource data 
specifies for each resource item a storage location of said resource item. 

87. (original) Apparatus as claimed in claim 86, wherein said storage location of 
said resource item is specified as an relative offset value. 

88. (original) Apparatus as claimed in claim 81, v^erein said resource data 
specifies for each resource item a size of said resource item. 
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89. (currently amended) Apparatus as claimed in claim [84]8i3 wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resoxirce data^ 

and 

sizes of program resource items within said resource data, 

90. (cancelled) 

91. (currently amended) Apparatus as claimed in claim [84] 81, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resoxirce item having a largest size. 

92. (currently amended) Apparatus as claimed in claim [84]8i, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

93. (cancelled) 

94. (original) Apparatus as clmmed in claim 89, wherein said checksum value is 
rotated between each item being added into said checksxmi. 
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95, (original) Apparatus as claimed in claim 81, wiierein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

96. (original) Apparatus as claimed in claim 81, wherein said packed computer 
file is a Win32 PE file. 
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